@vue/babel-plugin-resolve-type

Name lookalikedanger

The package resembles the far more established `resolve` package, with 829 million monthly downloads versus 13 million and 93 stable releases versus 11. The README is also identified as referring to the lookalike, making this a severe identity risk for consumers.

Repo package mentioncaution

The linked repository is `vuejs/babel-plugin-jsx`, does not match the package name, and does not mention this package in its README. Although a subpackage can legitimately live in a monorepo, these values leave package ownership and provenance less transparent.

Security policycaution

The repository has no security policy and no reported security-scanning tools. This is a transparency and maintenance-process gap, though it is not evidence that the release is unsafe.

Workflow auditcaution

All four workflows were analyzed with no high-confidence audit findings, unsafe untrusted checkouts, or script injections. However, 3 of 4 action references are unpinned, which weakens build reproducibility.